For a couple of years, "AI regulation" in the US meant a lot of announced frameworks and very little that a company had to do differently on a Monday morning. That changed over about five weeks this summer.

Three states passed laws taking three quite different approaches — one aimed at frontier models, one at chatbot interfaces, one at content provenance — a federal regulator signalled enforcement on a fourth front, and the bill meant to harmonise all of it stalled. None of these were sweeping. Together they are the first set of US AI rules with concrete obligations and dates attached.

Illinois: somebody outside the company has to look at the model

In July, Illinois enacted the Artificial Intelligence Safety Measures Act, known as SB 315. Legal analyses describe it as the first US state law to require independent third-party safety audits of frontier AI models, applying to developers above a revenue threshold, with civil penalties reported at up to $3 million per violation. The main obligations take effect before January 2028.

The audit requirement is what makes this different from the transparency laws that came before it. A disclosure rule asks a company to publish what it knows about its own model. An audit rule asks somebody else to go and check. Those sound similar and are not: the first produces a document written by the party with the strongest interest in how it reads, and the second produces one written by a party that has to put its own name on the assessment.

Whether it works in practice depends almost entirely on details that are not settled yet — who is qualified to audit a frontier model, what they get access to, and whether a company that fails an audit can simply commission another one. Those questions have taken years to answer badly in financial auditing, and there is no reason to expect them to resolve faster here.

Colorado: a law about the interface, not the model

Colorado signed a Chatbot Safety Act on 1 July, described as the first US state law written specifically for conversational AI rather than AI systems in general. Where minors are concerned, it restricts features that encourage emotional dependency, gamification mechanics, and inappropriate content.

What is interesting about it is where it locates the harm. Most AI regulation aims at the model: what it was trained on, what it can output, how capable it is. Colorado aimed at the product wrapped around the model — streaks, simulated affection, variable reward schedules, the mechanics that make an app difficult to put down. Those are decisions a design team makes in a sprint planning meeting, not properties that emerge from training.

That framing has a practical consequence. A company cannot comply by swapping the underlying model, because the model was never the thing being regulated. It has to change the product.

California: provenance became enforceable in August

California's SB 942 provenance requirements became enforceable on 2 August 2026. In broad terms they require disclosure that content was generated by AI, together with documentation of where it came from.

Provenance is one of the few AI rules that is genuinely technical rather than procedural. It is not asking for a policy document; it is asking for a durable signal attached to a file, which is an engineering problem with known failure modes — signals get stripped by re-encoding, screenshots destroy them, and a determined actor removes them deliberately. The rule still does useful work in the ordinary case, which is most content most of the time, but it is not a detector and does not pretend to be.

A separate cross-border transparency regime with overlapping obligations took effect on the same date. For anyone shipping a product internationally, the practical result is that compliance now gets built to whichever standard is strictest and applied everywhere, because maintaining two disclosure behaviours in one product is more expensive than complying twice over.

The FTC took aim at the gap between the marketing and the tuning

On 1 July the Federal Trade Commission issued a policy statement signalling that it would treat a company quietly steering its AI outputs away from accuracy, while marketing that system as optimised for performance, as deceptive conduct under Section 5 — and that complying with state law would not shield the behaviour.

This one is worth reading carefully if you build on top of models rather than train them. The target is not inaccuracy; models are inaccurate all the time and everybody knows it. The target is the distance between what a product claims about its outputs and what it has actually been tuned to produce. A user cannot see the tuning. The claim on the label is the only thing they can act on, which is exactly the situation consumer protection law was built for.

The federal bill that was meant to simplify this did not

The bipartisan Great American AI Act was still a discussion draft through July, with reporting attributing the delay to disagreement over preemption — whether a federal standard should override state rules or sit alongside them.

That is the entire argument, and it is not a technical one. A federal law that overrides state rules would replace Illinois audits, Colorado's chatbot provisions and California's provenance duties with one national standard. A federal law that sits alongside them adds a layer. Which states get to keep their stricter rules is a question about power rather than about AI, and it is why the bill has not moved.

Until it does, the operating reality for developers is the patchwork: several sets of obligations with different triggers, different thresholds and different enforcement dates, all live at once.

If you ship a product, three things follow

Work out whether you are a developer or a deployer. Most of these laws distinguish between the party that builds a model and the party that puts it in front of users, and the obligations differ sharply. A company fine-tuning an existing model and shipping it in an app is often in both categories at once, which is the least comfortable place to be.

Check the thresholds before assuming you are exempt. The frontier-model rules are aimed at large developers, but revenue thresholds move, and rules written for chatbots or provenance frequently have no threshold at all.

Write down what your product actually does. The FTC statement, the audit requirements and the provenance rules all reward the same unglamorous thing: an accurate internal record of how the system was tuned, what it was told to do, and what it was claimed to do in marketing. Companies that keep that record find compliance to be paperwork. Companies that do not find it to be archaeology.

This is a description of what the rules say, not legal advice. If any of it touches your product, the person to ask is a lawyer in the relevant jurisdiction. Our legal and compliance tools directory lists software in this area — the AI risk management software page covers the platforms teams use to track these obligations — and the AI regulation timeline tracks each change in date order.